dcrat | ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Size

4.9MB
MD5

364f9aa7879d48ffeb12ca794d1a1fb6
SHA1

7c5e4c6237881d714d43a95cfe69a4d15d8ff641
SHA256

ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7
SHA512

a6175b2facffdc57a98e77791cff47cf3b4ffba13e0ae433052bb70bdf94948a2724d0ba7e993094bb63f248dae9f78b8f615b7676299442b37aee61efc5492d
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8O:O

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2832	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2832	schtasks.exe	30

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1820-2-0x000000001B940000-0x000000001BA6E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2632	powershell.exe
2760	powershell.exe
1036	powershell.exe
2900	powershell.exe
2964	powershell.exe
2872	powershell.exe
3024	powershell.exe
584	powershell.exe
3028	powershell.exe
2624	powershell.exe
1644	powershell.exe
2992	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
2192	OSPPSVC.exe
2360	OSPPSVC.exe
1580	OSPPSVC.exe
1712	OSPPSVC.exe
2800	OSPPSVC.exe
1680	OSPPSVC.exe
2560	OSPPSVC.exe
2536	OSPPSVC.exe
3032	OSPPSVC.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\System.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Defender\es-ES\f3b6ecef712a24	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\lsm.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCXD4DA.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\lsm.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\27d1bcfc3c54e0	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXCB83.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\winlogon.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\RCXC77C.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\a2d8cf41b57927	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\System.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\7a0fd90576e088	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCXC307.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Journal\es-ES\winlogon.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Journal\es-ES\cc11b995f2a76d	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Defender\es-ES\spoolsv.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\RCXBA1C.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\RCXC096.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\spoolsv.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCXD269.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\101b941d020240	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Registration\CRMLog\RCXBC20.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\Registration\CRMLog\explorer.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\AppCompat\Programs\RCXC50B.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\AppCompat\Programs\lsass.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\Registration\CRMLog\explorer.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\Registration\CRMLog\7a0fd90576e088	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\AppCompat\Programs\lsass.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\AppCompat\Programs\6203df4a6bafc7	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1708	schtasks.exe
1748	schtasks.exe
2036	schtasks.exe
336	schtasks.exe
2760	schtasks.exe
2040	schtasks.exe
1444	schtasks.exe
2984	schtasks.exe
2876	schtasks.exe
2504	schtasks.exe
1020	schtasks.exe
2088	schtasks.exe
968	schtasks.exe
2908	schtasks.exe
2888	schtasks.exe
624	schtasks.exe
900	schtasks.exe
840	schtasks.exe
2892	schtasks.exe
1292	schtasks.exe
2480	schtasks.exe
2824	schtasks.exe
2752	schtasks.exe
1328	schtasks.exe
884	schtasks.exe
780	schtasks.exe
2228	schtasks.exe
2164	schtasks.exe
2268	schtasks.exe
2372	schtasks.exe
2788	schtasks.exe
600	schtasks.exe
2644	schtasks.exe
2692	schtasks.exe
2868	schtasks.exe
2696	schtasks.exe
1056	schtasks.exe
1028	schtasks.exe
2972	schtasks.exe
2764	schtasks.exe
1872	schtasks.exe
544	schtasks.exe
2536	schtasks.exe
608	schtasks.exe
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
2992	powershell.exe
584	powershell.exe
3028	powershell.exe
2900	powershell.exe
1644	powershell.exe
2632	powershell.exe
2872	powershell.exe
2760	powershell.exe
2964	powershell.exe
2624	powershell.exe
1036	powershell.exe
3024	powershell.exe
2192	OSPPSVC.exe
2360	OSPPSVC.exe
1580	OSPPSVC.exe
1712	OSPPSVC.exe
2800	OSPPSVC.exe
1680	OSPPSVC.exe
2560	OSPPSVC.exe
2536	OSPPSVC.exe
3032	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2192	OSPPSVC.exe
Token: SeDebugPrivilege	2360	OSPPSVC.exe
Token: SeDebugPrivilege	1580	OSPPSVC.exe
Token: SeDebugPrivilege	1712	OSPPSVC.exe
Token: SeDebugPrivilege	2800	OSPPSVC.exe
Token: SeDebugPrivilege	1680	OSPPSVC.exe
Token: SeDebugPrivilege	2560	OSPPSVC.exe
Token: SeDebugPrivilege	2536	OSPPSVC.exe
Token: SeDebugPrivilege	3032	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2900	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	77
PID 1820 wrote to memory of 2900	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	77
PID 1820 wrote to memory of 2900	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	77
PID 1820 wrote to memory of 2624	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	78
PID 1820 wrote to memory of 2624	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	78
PID 1820 wrote to memory of 2624	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	78
PID 1820 wrote to memory of 1644	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	79
PID 1820 wrote to memory of 1644	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	79
PID 1820 wrote to memory of 1644	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	79
PID 1820 wrote to memory of 2964	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	80
PID 1820 wrote to memory of 2964	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	80
PID 1820 wrote to memory of 2964	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	80
PID 1820 wrote to memory of 2992	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	81
PID 1820 wrote to memory of 2992	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	81
PID 1820 wrote to memory of 2992	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	81
PID 1820 wrote to memory of 2872	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	83
PID 1820 wrote to memory of 2872	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	83
PID 1820 wrote to memory of 2872	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	83
PID 1820 wrote to memory of 3024	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	84
PID 1820 wrote to memory of 3024	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	84
PID 1820 wrote to memory of 3024	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	84
PID 1820 wrote to memory of 584	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	85
PID 1820 wrote to memory of 584	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	85
PID 1820 wrote to memory of 584	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	85
PID 1820 wrote to memory of 2632	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	86
PID 1820 wrote to memory of 2632	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	86
PID 1820 wrote to memory of 2632	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	86
PID 1820 wrote to memory of 2760	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	87
PID 1820 wrote to memory of 2760	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	87
PID 1820 wrote to memory of 2760	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	87
PID 1820 wrote to memory of 1036	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	88
PID 1820 wrote to memory of 1036	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	88
PID 1820 wrote to memory of 1036	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	88
PID 1820 wrote to memory of 3028	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	89
PID 1820 wrote to memory of 3028	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	89
PID 1820 wrote to memory of 3028	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	89
PID 1820 wrote to memory of 2192	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	101
PID 1820 wrote to memory of 2192	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	101
PID 1820 wrote to memory of 2192	1820	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	101
PID 2192 wrote to memory of 2308	2192	OSPPSVC.exe	102
PID 2192 wrote to memory of 2308	2192	OSPPSVC.exe	102
PID 2192 wrote to memory of 2308	2192	OSPPSVC.exe	102
PID 2192 wrote to memory of 2752	2192	OSPPSVC.exe	103
PID 2192 wrote to memory of 2752	2192	OSPPSVC.exe	103
PID 2192 wrote to memory of 2752	2192	OSPPSVC.exe	103
PID 2308 wrote to memory of 2360	2308	WScript.exe	104
PID 2308 wrote to memory of 2360	2308	WScript.exe	104
PID 2308 wrote to memory of 2360	2308	WScript.exe	104
PID 2360 wrote to memory of 2492	2360	OSPPSVC.exe	105
PID 2360 wrote to memory of 2492	2360	OSPPSVC.exe	105
PID 2360 wrote to memory of 2492	2360	OSPPSVC.exe	105
PID 2360 wrote to memory of 2508	2360	OSPPSVC.exe	106
PID 2360 wrote to memory of 2508	2360	OSPPSVC.exe	106
PID 2360 wrote to memory of 2508	2360	OSPPSVC.exe	106
PID 2492 wrote to memory of 1580	2492	WScript.exe	107
PID 2492 wrote to memory of 1580	2492	WScript.exe	107
PID 2492 wrote to memory of 1580	2492	WScript.exe	107
PID 1580 wrote to memory of 2996	1580	OSPPSVC.exe	108
PID 1580 wrote to memory of 2996	1580	OSPPSVC.exe	108
PID 1580 wrote to memory of 2996	1580	OSPPSVC.exe	108
PID 1580 wrote to memory of 1284	1580	OSPPSVC.exe	109
PID 1580 wrote to memory of 1284	1580	OSPPSVC.exe	109
PID 1580 wrote to memory of 1284	1580	OSPPSVC.exe	109
PID 2996 wrote to memory of 1712	2996	WScript.exe	110

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
"C:\Users\Admin\AppData\Local\Temp\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Users\All Users\Templates\OSPPSVC.exe
  "C:\Users\All Users\Templates\OSPPSVC.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2192
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75a7b480-66aa-4b64-80ea-8e3ab99db3b8.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Users\All Users\Templates\OSPPSVC.exe
      "C:\Users\All Users\Templates\OSPPSVC.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2360
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43070c72-6c25-469a-bc90-09ab475bdd0e.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Users\All Users\Templates\OSPPSVC.exe
        
        "C:\Users\All Users\Templates\OSPPSVC.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1a65e73-c420-43f1-951b-a60b1dc7b382.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Users\All Users\Templates\OSPPSVC.exe
        
        "C:\Users\All Users\Templates\OSPPSVC.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38c064f5-9882-42d6-a482-f2b6bbd0782e.vbs"
        9⤵
        
        PID:1868
        
        C:\Users\All Users\Templates\OSPPSVC.exe
        
        "C:\Users\All Users\Templates\OSPPSVC.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57b5cce3-4e4f-4763-99c9-ed49d27b5c7a.vbs"
        11⤵
        
        PID:2668
        
        C:\Users\All Users\Templates\OSPPSVC.exe
        
        "C:\Users\All Users\Templates\OSPPSVC.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0db5a766-1d99-4e50-ba8a-4579c65f7dcf.vbs"
        13⤵
        
        PID:2252
        
        C:\Users\All Users\Templates\OSPPSVC.exe
        
        "C:\Users\All Users\Templates\OSPPSVC.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a72e590e-e3bd-4efb-9a45-ed1955942fa1.vbs"
        15⤵
        
        PID:1052
        
        C:\Users\All Users\Templates\OSPPSVC.exe
        
        "C:\Users\All Users\Templates\OSPPSVC.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b56aab5-5030-4178-af74-0c45061a9a6a.vbs"
        17⤵
        
        PID:1036
        
        C:\Users\All Users\Templates\OSPPSVC.exe
        
        "C:\Users\All Users\Templates\OSPPSVC.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ae1f6f7-5c56-4b80-81a8-3635286559ea.vbs"
        17⤵
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81e56774-d8f7-4992-8cc8-e13d42a98b56.vbs"
        15⤵
        
        PID:1148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19021d8d-a51f-4326-966f-4b5fddaf2145.vbs"
        13⤵
        
        PID:2036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62396df3-c436-4aaa-af24-94af45f19e63.vbs"
        11⤵
        
        PID:812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a43e941-bc04-451e-8085-bac6938e53fa.vbs"
        9⤵
        
        PID:2120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ce1ff65-6e26-49d7-a368-57a1b3e5d0e8.vbs"
        7⤵
        
        PID:1284
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbd0afb0-5514-4261-b5b4-b5d1766b2aae.vbs"
        5⤵
        
        PID:2508
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcd9f224-818f-4abb-b56e-14baf41f84a8.vbs"
    3⤵
    PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\Registration\CRMLog\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Templates\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Templates\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Journal\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Journal\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\AppCompat\Programs\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\AppCompat\Programs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\Sample Music\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\Sample Music\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7e" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7e" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Default\My Documents\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\My Documents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Default\My Documents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe

Filesize
4.9MB

MD5
364f9aa7879d48ffeb12ca794d1a1fb6

SHA1
7c5e4c6237881d714d43a95cfe69a4d15d8ff641

SHA256
ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7

SHA512
a6175b2facffdc57a98e77791cff47cf3b4ffba13e0ae433052bb70bdf94948a2724d0ba7e993094bb63f248dae9f78b8f615b7676299442b37aee61efc5492d

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\es-ES\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe

Filesize
4.9MB

MD5
5857590e0c06900b5833765656acd269

SHA1
381b8ec511502891e051a50dd25031fe909f87f5

SHA256
4f4f1a460befd585fd8348e470ee1d22cb78d19194edeacdcd41499161f470bc

SHA512
e7a6b973a984986f088551042d72462a204e66bac326c6c15530abc3e813aab0e2c508a1e4cb78328e8f12c0f6e682a5586738eb1b87cf6863f94e4a293fa9e3

Download Submit
C:\ProgramData\Microsoft\Windows\Templates\OSPPSVC.exe

Filesize
4.9MB

MD5
794017c94fea1b2276ac8581c82de553

SHA1
a55914e509b5889e39ac8b10fece1bc7257759d2

SHA256
f468d28396865df3c0d6286d75dd740d6bdead04d3ab3f0e39784fcbbc2f920b

SHA512
bf959ec79e6892c8ac8b9aed16c76ebe2d2d098a540bb98064cd69354d59518fb553257925ac9823714fb93f5a8b14fda6c5e74222a55746933e8690478e5459

Download Submit
C:\Users\Admin\AppData\Local\Temp\0db5a766-1d99-4e50-ba8a-4579c65f7dcf.vbs

Filesize
716B

MD5
cfa743b1c8c112513fe15db079ee59da

SHA1
c82c413e4b7f38a68d3259b4d641c84e3d3dcde0

SHA256
c35df546edfc5c77b668aca5e99fbacdeaf62160c36d95feca2509232f129c4b

SHA512
73c355c65f817dc7f31fe3b7dce165f0bdb2d6e0d713345bbf4c6629d9556cdb3aa73d7a8c6b3a4bd02cdffca30effe8885148d1fb7dac26ab96c7854a6393ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\38c064f5-9882-42d6-a482-f2b6bbd0782e.vbs

Filesize
716B

MD5
a346a1d7cdc048fd821583edf4a7f9ff

SHA1
81f86b4fe127372a71c864441ed1d8a0ade59cc6

SHA256
a0ea7e0df2d2d5311427e2c8ea82bc7f7ecc9f6bf093ae868f1d73b8409aa538

SHA512
e898a1d3f296fc105f0a872bee30f7ed31c1c0bbebb942d29bdbb5d8329a0d03ad90dd4f773017cd6daa61e5d908a7675872432b691d714c873eafc7fe015521

Download Submit
C:\Users\Admin\AppData\Local\Temp\43070c72-6c25-469a-bc90-09ab475bdd0e.vbs

Filesize
716B

MD5
01a7ea59a523662cb92d81d25e1d9561

SHA1
dd2c571fdfc539c9582453662320a9445aed157a

SHA256
5be2e1a587d8290a1a2367b290dc755fcc53c9a81c4a1ea39a3ba12464ff3819

SHA512
f3c79305e2e25bf1fdba09cde547e5f3c09c72ddb9671df25330fe13f4583c381d0971d6d7470205ef78bed1e0e582c1e83606a5c21a46c9f78f03cc83882b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\57b5cce3-4e4f-4763-99c9-ed49d27b5c7a.vbs

Filesize
716B

MD5
5e20c9f552778d06b543edddc6975167

SHA1
9d8c590813e87b56ce095198515d5c9f73918c52

SHA256
2698db8795a952d4125704d9de4144e70efd08c0ba746e59a95d85dee20fbf62

SHA512
0d62dcefdc3014e4cd4812169b457242f1210e23cb7564fc1152b4fc41032ed24ee2fcdd766014580ce0e9c096046f99ffb3ee2d4a315625a9c6f0712fa3e210

Download Submit
C:\Users\Admin\AppData\Local\Temp\6b56aab5-5030-4178-af74-0c45061a9a6a.vbs

Filesize
716B

MD5
ad2b562c474f0b84717801863bc2e5c4

SHA1
ebdb9c1a77c050dd9e99ac9d206220a88b0117d7

SHA256
002ac62bc40deb47aa22ac3f080348d795641369db012b6df476a2958fcd80f8

SHA512
08b6006d165b9545e2b081c9db98b71aa7626ac4daebbb0c909e574daa4846ed7d0c852f2345b2d50881396683d176dc73a2485b2f369bf584d00f8dff19c9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\75a7b480-66aa-4b64-80ea-8e3ab99db3b8.vbs

Filesize
716B

MD5
99ebc643cf77028be155d369a92c8d3c

SHA1
ebd38bbbcdacfaeed6dc6489c4eb5135a34d4c24

SHA256
4ec8add76bc176c0f05cdb4c3bcdcc9fda26c0c97ad1e125e2059a350118faba

SHA512
93841dd6fb4b5532f9d8e2dfd45998db07dbb109bd97645431d37adac0e74ea0c56351aac006847311cb12b7a1f9e00864904bc0c5f3bfee13d3fc5021ae29ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\a72e590e-e3bd-4efb-9a45-ed1955942fa1.vbs

Filesize
716B

MD5
c4de8cc98198ab2f361617c5c30a2cba

SHA1
4d6b6033edbc9334db83386d303bfe18d06c4228

SHA256
d677178d565e77de4bc1a59136adf5b46efb617265e863a2dd405f8401bf2d69

SHA512
dccb58585861f3ae6393561450730dedf134c4ff8252b11156587e2863c4e075310c9d891f0dcc76cb4c050b32d0945d64cbc44fdc9d77a730b26166216d3b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1a65e73-c420-43f1-951b-a60b1dc7b382.vbs

Filesize
716B

MD5
e24980f42073b91b2588065c9700639d

SHA1
5f0f05b464646ed14496e42c31a7a63835cc139f

SHA256
4948b9bbf6acf1fc4095c285e322a8c1cb7c031dea270f61318577abb03ec574

SHA512
20c689d225059f3afb5b7f1d22b00a93c0bc1f97c16fa4c6f1a0835999c92c9da1cdf8865b526c0cf9130fd79b3f678bf38a6f37130257896dcda9fde0712c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcd9f224-818f-4abb-b56e-14baf41f84a8.vbs

Filesize
492B

MD5
d369a9d708054485d4ae3461e5fe895f

SHA1
feff403761961c8a5ab839a07a0afa49e0122a85

SHA256
4696aa9a03605c2822148694babfe08e872d999da1a0fe1543c988a589cd5884

SHA512
b19377571e80d509ff98688a0b341696696731bcd32b858e81aa2120970e27bbf5c94739a3016abbbf3f5fba32ae154e16d379fc2a39edff913fdcaae9fbfc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE984.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8UPE223YXP9D7IAO2VFM.temp

Filesize
7KB

MD5
77468789967416a49a9b8c2ac8f3c26a

SHA1
9f35a239717944a490dc6902824c56caa0804225

SHA256
d421175a19b957a45808c1ad97443fc48272eab726934e57677720b990bb5650

SHA512
6851e9785735e578051a0cc917e431d408d5f1d0a3b5a4d533a5e2a8912bba3854ffc9fef288133c2010c75d52c875536c4b6216d5145206d88e9bc3dbddc01b

Download Submit
memory/1680-294-0x0000000000D20000-0x0000000001214000-memory.dmp

Filesize
5.0MB

Download
memory/1820-10-0x00000000009B0000-0x00000000009C2000-memory.dmp

Filesize
72KB

Download
memory/1820-6-0x0000000000960000-0x0000000000970000-memory.dmp

Filesize
64KB

Download
memory/1820-16-0x0000000002430000-0x000000000243C000-memory.dmp

Filesize
48KB

Download
memory/1820-15-0x0000000002420000-0x0000000002428000-memory.dmp

Filesize
32KB

Download
memory/1820-137-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

Filesize
4KB

Download
memory/1820-152-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1820-13-0x0000000002400000-0x000000000240E000-memory.dmp

Filesize
56KB

Download
memory/1820-1-0x0000000000360000-0x0000000000854000-memory.dmp

Filesize
5.0MB

Download
memory/1820-12-0x0000000002370000-0x000000000237E000-memory.dmp

Filesize
56KB

Download
memory/1820-2-0x000000001B940000-0x000000001BA6E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-220-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1820-3-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1820-4-0x00000000002C0000-0x00000000002DC000-memory.dmp

Filesize
112KB

Download
memory/1820-11-0x0000000002360000-0x000000000236A000-memory.dmp

Filesize
40KB

Download
memory/1820-0-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

Filesize
4KB

Download
memory/1820-9-0x00000000009A0000-0x00000000009AA000-memory.dmp

Filesize
40KB

Download
memory/1820-5-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1820-8-0x0000000000990000-0x00000000009A0000-memory.dmp

Filesize
64KB

Download
memory/1820-7-0x0000000000970000-0x0000000000986000-memory.dmp

Filesize
88KB

Download
memory/1820-14-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2192-222-0x0000000000660000-0x0000000000672000-memory.dmp

Filesize
72KB

Download
memory/2192-219-0x0000000000A00000-0x0000000000EF4000-memory.dmp

Filesize
5.0MB

Download
memory/2360-236-0x0000000001150000-0x0000000001644000-memory.dmp

Filesize
5.0MB

Download
memory/2632-211-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2800-279-0x0000000000140000-0x0000000000634000-memory.dmp

Filesize
5.0MB

Download
memory/2992-221-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/3032-337-0x0000000000250000-0x0000000000744000-memory.dmp

Filesize
5.0MB

Download